NIFI-11370 Correct JWK Set retrieval for NIFI Trust Strategy

[exceptionfactory]

Summary

NIFI-11370 Corrects JSON Web Key Set retrieval when using the NIFI Trust Store Strategy.

The NIFI trust store strategy can be configured using nifi.security.user.oidc.truststore.strategy in application properties for integrating with Identity Providers that do not use certificates issued from public authorities.

The standard Spring Security OidcIdTokenDecoderFactory implementation does not support providing an instance of RestOperations to the NimbusJwtDecoder builder, which results in using the default Java trust store instead of the NiFi trust store strategy.

The new StandardOidcIdTokenDecoderFactory supports a configurable instance of RestOperations, which is configured in the OidcSecurityConfiguration. The new Decoder Factory supports the same capabilities as the default Spring Security implementation in terms of JWS algorithms allowed.

Tracking

Please complete the following tracking steps prior to pull request creation.

Issue Tracking

• Apache NiFi Jira issue created

Pull Request Tracking

• Pull Request title starts with Apache NiFi Jira issue number, such as NIFI-00000
• Pull Request commit message starts with Apache NiFi Jira issue number, as such NIFI-00000

Pull Request Formatting

• Pull Request based on current revision of the main branch
• Pull Request refers to a feature branch with one commit containing changes

Verification

Please indicate the verification steps performed prior to pull request creation.

Build

• Build completed using mvn clean install -P contrib-check
  • JDK 11
  • JDK 17

Licensing

• New dependencies are compatible with the Apache License 2.0 according to the License Policy
• New dependencies are documented in applicable LICENSE and NOTICE files

Documentation

• Documentation formatting appears as expected in rendered files

[mtien-apache]

Reviewing.

[mtien-apache]

Thanks for the PR, @exceptionfactory! I tested by changing the default Java cacerts and configured with an ID provider (tested with Okta and Azure). I verified I can log in with both providers.